So, in English, for each lookupField value, there is a line in the lookup table that contains some information, including up_range and lookupGroup
For the events that belong to each lookupGroup, you want to run the macro. Then you want each of the stats lines at the end of each run of the macro to be output.
All you need is to update your macro with "by lookupGroup in three places and run it once for the whole input. Here I assume that lookupGroup and up_range are the only fields that come from the lookup, and that weight` field is on the events themselves.
index=test
| fields lookupField weight
| lookup testLookup lookupField
| eval weight_low_val = if(weight=11, up_range, 100)
| eval weight_new = if(weight=11, 0, weight)
| eventstats sum(weight_new) as weight_sum by lookupGroup
| eval wavg = (up_range*weight_new)/weight_sum
| eventstats sum(wavg) as wavg_sum by lookupGroup
| eval wavg_min_val = if(weight_low_val<wavg_sum, weight_low_val, wavg_sum)
| stats min(wavg_min_val) as health_score by lookupGroup
The above code would accomplish the same thing as the macro run against the individual groups... but we are not certain the original macro code was correct. We are especially suspicious of the calculation between the two eventstats commands. However, if the original code was correct, this will produce the same output in one pass.
... View more